Note for Cryptography And Network Security - CNS by shaik shabeer

Topics ( 7 )

Text from page-1

ST.ANN'S COLLEGE OF ENGINEERING & TECHNOLOGY,CHIRALA CSE Cryptography and Network Security UNIT-1 Syllabus: UNIT I: Classical Encryption Techniques Introduction: Security attacks, services & mechanisms, Symmetric Cipher Model, Substitution Techniques, Transportation Techniques, Cyber threats and their defense (Phishing Defensive measures, web based attacks, SQL injection & Defense techniques), Buffer overflow & format string vulnerabilities, TCP session hijacking (ARP attacks, route table modification) UDP hijacking (man-in-the-middle attacks). Objectives: The Objectives of this unit is to present an overview of the main concepts of cryptography, understand the threats & attacks, understand ethical hacking. COMPUTER SECURITY CONCEPTS: The National Institute of Standards and Technology (NIST) defines the term computer security as follows:  The protection afforded to an automated information system in order to attain the applicable objectives of preserving the integrity, availability, and confidentiality of information system resources (includes hardware, software, firmware, information/ data, and telecommunications). This definition introduces three key objectives that are at the heart of computer security: Confidentiality: This term covers two related concepts:  Data confidentiality: Assures that private or confidential information is not made available or disclosed to unauthorized individuals.  Privacy: Assures that individuals control or influence what information related to them may be collected and stored and by whom and to whom that information may be disclosed. Integrity: This term covers two related concepts:  Data integrity: Assures that information and programs are changed only in a specified and authorized manner.  System integrity: Assures that a system performs its intended function in an unaffected manner, free from deliberate or inadvertent unauthorized manipulation of the system. Availability: Availability of information refers to ensuring that authorized parties are able to access the information when needed. E S T E C C A S Figure: CIA Triad THE OSI SECURITY ARCHITECTURE  The Open Systems Interconnection (OSI) security architecture provides a systematic framework for defining security attacks, mechanisms, and services. BASIC TERMINOLOGY: Threat: A potential for violation of security, which exists when there is a circumstance, capability, action, or event that could breaks security and cause harm. That is, a threat is a possible danger that might exploit a vulnerability. Attack: A violation on system security that derives from an intelligent threat; that is, an i ntelligent act that is a deliberate attempt to evade security services and violate the security policy of a system. ASPECTS OF SECURITY: consider 3 aspects of information security:  Security attack: Any action that compromises the security of information owned by an organization.

Text from page-2

ST.ANN'S COLLEGE OF ENGINEERING & TECHNOLOGY,CHIRALA   CSE Security mechanism: A process that is designed to detect, prevent, or recover from a security attack. Security service: A processing or communication service that enhances the security of the data processing systems and the information transfers of an organization. The services are intended to counter security attacks, and they make use of one or more security mechanisms to provide the service. SECURITY ATTACKS: Security attacks are classifieds into two:  Passive attacks and  Active attacks. A passive attack attempts to learn or make use of information from the system but does not affect system resources. An active attack attempts to alter system resources or affect their operation. Passive Attacks: Passive attacks are in the nature of eavesdropping on, or monitoring of, transmissions. The goal of the opponent is to obtain information that is being transmitted. Two types of passive attacks are the release of message contents and traffic analysis. Release of message contents: The release of message contents is easily understood. A telephone conversation, an electronic mail message, and a transferred file may contain sensitive or confidential information. We would like to prevent an opponent from learning the contents of these transmissions. E S T E TRAFFIC ANALYSIS:         C C A S Suppose that we had a way of masking the contents of messages or other information traffic so that opponents, even if they captured the message, could not extract the information from the message. The common technique for masking contents is encryption. If we had encryption protection in place, an opponent might still be able to observe the pattern of these messages. The opponent could determine the location and identity of communicating hosts and could observe the frequency and length of messages being exchanged. This information might be useful in guessing the nature of the communication that was taking place. Passive attacks are very difficult to detect, because they do not involve any alteration of the data. Typically, the message traffic is sent and received in an apparently normal fashion, and neither the sender nor receiver is aware that a third party has read the messages or observed the traffic pattern. However, it is feasible to prevent the success of these attacks, usually by means of encryption. Thus, the emphasis in dealing with passive attacks is on prevention rather than detection. Active Attacks: Active attacks involve some modification of the data stream or the creation of a false stream and can be subdivided into four categories: masquerade, replay, modification of messages, and denial of service.

Text from page-3

ST.ANN'S COLLEGE OF ENGINEERING & TECHNOLOGY,CHIRALA CSE A masquerade attack is an attack that uses a fake identity, to gain unauthorized access to personal computer information through legitimate access identification. For example, authentication sequences can be captured and replayed after a valid authentication sequence has taken place, thus enabling an authorized entity with few privileges to obtain extra privileges by impersonating an entity that has those privileges. Replay involves the passive capture of a data unit and its subsequent retransmission to produce an unauthorized effect. Modification of messages simply means that some portion of a valid message is altered, or that messages are delayed or reordered, to produce an unauthorized effect. For example, a message meaning “Allow John Smith to read confidential file accounts” is modified to mean “Allow Fred Brown to read confidential file accounts.” E S T E C C A S The denial of service prevents the normal use or management of communications facilities. This attack may have a specific target; for example, an entity may suppress all messages directed to a particular destination. Another form of service denial is the disruption of an entire network, either by disabling the network or by overloading it with messages so as to degrade performance. SECURITY SERVICES:  Security service means a processing or communication service that is provided by a system to give a specific kind of protection to system resources.  X.800 divides these services into  AUTHENTICATION  ACCESS CONTROL  DATA CONFIDENTIALITY  DATA INTEGRITY  NONREPUDIATION  AVAILABILITY AUTHENTICATION: The authentication service is concerned with assuring that a communication is authentic. In the case of a single message, its function of the authentication service is to assure the recipient that the message is from the source that it claims to be from. In the case of an ongoing interaction, such as the connection of a terminal to a host, two aspects are involved. First, at the time of connection initiation, the service assures

Text from page-4

ST.ANN'S COLLEGE OF ENGINEERING & TECHNOLOGY,CHIRALA CSE that the two entities are authentic, that is, that each is the entity that it claims to be. Second, the service must assure that the connection is not interfered with in such a way that a third party can masquerade as one of the two legitimate parties for the purposes of unauthorized transmission or reception. Two specific authentication services are defined  Peer entity authentication  Data origin authentication Peer entity authentication: Provides for the corroboration of the identity of a peer entities involved in communication. It is used for providing authentication at the time of connection establishment and during the process of data transmission. Data origin authentication: Provides for the corroboration of the source of a data unit. It does not provide protection against the duplication or modification of data units. This type of service supports applications like electronic mail, where there are no prior interactions between the communicating entities . ACCESS CONTROL: The prevention of unauthorized use of a resources. Access control is the ability to limit and control the access to host systems and applications via communications links. To achieve this, each entity trying to gain access must first be identified, or authenticated, so that access rights can be tailored to the individual. DATA CONFIDENTIALITY: Confidentiality is the protection of transmitted data from passive attacks. The protection of data from unauthorized disclosure. Types of confidentiality: o Connection Confidentiality: The protection of all user data on a connection. o Connectionless Confidentiality: The protection of all user data in a single data block o Selective-Field Confidentiality: The confidentiality of selected fields within the user data on a connection or in a single data block. o Traffic-Flow Confidentiality: The protection of the information that might be derived from observation of traffic flows. DATA INTEGRITY: The assurance that data received are exactly as sent by an authorized entity (i.e., contain no modification, insertion, deletion, or replay). Types of integrity  Connection Integrity with Recovery: Provides for the integrity of all user data on a connection and detects any modification, insertion, deletion, or replay of any data within an entire data sequence, with recovery attempted.  Connection Integrity without Recovery as above, but provides only detection without recovery.  Selective-Field Connection Integrity Provides for the integrity of selected fields within the user data of a data block transferred over a connection and takes the form of determination of whether the selected fields have been modified, inserted, deleted, or replayed.  Connectionless Integrity Provides for the integrity of a single connectionless data block and may take the form of detection of data modification. Additionally, a limited form of replay detection may be provided.  Selective-Field Connectionless Integrity Provides for the integrity of selected fields within a single connectionless data block; takes the form of determination of whether the selected fields have been modified. NONREPUDIATION: It is assurance that someone cannot deny something. It is a method of guaranteeing message transmission between parties. Provides protection against denial by one of the entities involved in a communication of having participated in all or part of the communication.  Nonrepudiation, Origin: Proof that the message was sent by the specified party.  Nonrepudiation, Destination: Proof that the message was received by the specified party. AVAILABILITY: Availability is the method with assure the information and communications will be ready for use when excepted. Information is kept available to authorized persons when they need it. The availability can be significantly affected by a variety of attacks which are susceptible to authentication, encryption etc., whereas some attacks require physical action for preventing and recovering from the loss of availability E S T E C A S SECURITY MECHANISMS: Security mechanism are categorized into two types. They are,  SPECIFIC SECURITY MECHANISMS  PERVASIVE SECURITY MECHANISMS SPECIFIC SECURITY MECHANISMS: C